Secure Some Game data like Score [SOLVED]

[MrGamer]

Hi
In my game I need security on game score. Is there any good way to keep score safe so no one can change it without getting it by playing game. I also need to secure it even at runtime because there is some application like cheat engine which can change the values inside RAM. Any good suggestions for it.

[Fraser]

To stop casual tampering then could do this:

store score in xml elements.

element[1]
the raw score number as a string

elements[2]...[5]
take the raw score and apply a different math transform to each one.

Then when you read the score do inverse math transforms on [2]...[5] and check that they all fall within limits of real score [1] to validate.

You can use any transform provided you can code both foward and reverse transform

Increase the number of encoded elements to harden it up.

Transforms can be this (or more complex):

FORWARD
OUT = (IN * K + L) / M

INVERSE
OUT = (IN * M) / K - L

You could use a loop to generate lots of extra elements and have it change K,L,M as it progresses. Do same for the inverse check.

For better hardness then generate a long token from the score using CRC.

EDIT:
As for preventing RAM altering from cheat engine then you would have to wrap your built executable in some security wrapper, depending on your target platform. But nothing is perfect.

What is your plan, cash prize for first player to score X or something.

EDIT:
Changed SSL to CRC

[freezer]

my first thought was to use a hash function to use as a check back.
heres a simple one...
http://en.wikipedia.org/wiki/Computation_of_CRC#Implementation

and a quick search for "crc lua" threw out some examples... e.g.
http://luamemcached.googlecode.com/svn/trunk/CRC32.lua


p.s. crc32 will have collisions since it's quite simple...

[makkar]

Why don't you think about using local environment variables? They are by default securely stored on the device.

[MrGamer]

Thanks for your answers
in our game we want to lock our levels according to points. SO if somebody reach on a score limit then player can play next level. So we are looking a such method so no one can unlock level without playing it.

Why don't you think about using local environment variables? They are by default securely stored on the device.

Your idea of local environment variables id good to save score when player exit game but we also need a way so player cannot change it from RAM. So if data will be cahnged from RAM then same data will be saved on environment variables.
I thing Fraser idea may be work.

[Fraser]

A "hard" security wrapper for PC exes does cost you, "software passport" is probably the hardest commercially available.

I'm curious as to why you need to protect the levels completed variable so fiercely?

[MrGamer]

Thanks a lot everyone.
I can mix Fraser and makkar suggestion and can solve my problem.
Both are helpful.

[freezer]

never noticed this function before...

http://www.stonetrip.com/developer/doc/api/string-crc32